In terms of more flexible rights, perhaps a better idea is to keep the rights framework similar to how it already is.
For example, the current system works on the "r", "w" and "-" switches. Perhaps a new switch could be added to prevent the deletion of NPCs, say:
PHP Code:
rwd NPCS/SomeDatabase
... would prevent you from deleting the NPC, but:
PHP Code:
rw NPCS/SomeDatabase
... would allow you to delete the NPC.
It seems pointless adding rights to allow the adding of NPCs, though.